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CLAIMS 

WHAT IS CLAIMED IS: 

\^ 1. A method for associating file activity of an 
application with the graphical display of the file on a screen 
comprising the steps of: 

loading by an operating system an executable code of a 
messageXmonitoring program adapted to monitoring a message 
sent by a*n operating system to a document display window; 

establishing by the message monitoring program a system- 
wide window Viook using available operating system API 
functions, said system-wide window hook associated with one or 
more functions\in a library of said message monitoring 
program; 

loading the Message monitoring program library into the 
memory space of an \application program, said application 
having been newly started and having an import table and a 
newly created windows- 
fixing the import \able of the application with addresses 
of functions from the me\^age monitoring program library; and 
substituting the application's main window function with 
a message monitoring program, window function. 

2. The method of claim j\, further comprising creating a 
key window when an application rs started, said key window 
adapted to receive a message when\a file is opened and closed. 

3. The method of claim 2, further comprising: 
sending a message to the key window when a file is 

opened; 

creating a child notify window associated with said file; 

and 

creating a notify window as a child window of a document 
window associated with said file. 
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4. The method of claim 1, further comprising: 

creating a notify window when a document window is 

cremated, wherein the notify window is a child window of the 
\ 

document window; and 

receiving by the notify window a message from the 
operating\system when the parent document window is activated 
by either rfee application program or by action of a user. 

5. The method of claim 1, further comprising, upon 
receipt of a document window destroy message by a document's 
notify window, checking for the existence of a child notify 
window associated wim a file that was opened in association 
with said document, ana, acting upon said associated file 
before destroying said document window. 

6. The method of claita 5, comprising a user of an 
application specifying one orVore rules to the application, 
each said rule indicating an actSion to be taken on said 
associated file before destroying >said document window. 

7. The method of claim 6, wherein an action includes 
encrypting said associated file, whereii^ encrypting comprises 
the step of: 

creating a new file containing a template of the same 
format as said associated file, said new fil\ including a 
header, wherein said herder is not encrypted; 

copying to the new file a document summary N^n readable 

form; 

copying to the new file visual indicia represe>^ting that 
the file is encrypted; 
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copying encrypted data from the associated file to the 
ne\ file as a named stream, said encrypted data having a 
beginning and a length; and 

writing a code to a substitute stream to prevent the new 
file from being written over by a user. 

8. method of claim 7, further comprising the step 
of including \n the header a flag indicative of the type of 
encryption useckon the associated file. 

9. The method of claim 7, further comprising the step 
of including in the nteader a flag indicative of a handling 
procedure to be performed on said encrypted file. 

10. The method of clasim 7, further comprising the step 
of loading data from the encrypted file into a memory block 
containing other random data, seid memory block having a 
beginning, wherein an offset fronv the beginning of the memory 
block of the data from the encrypted file changes each time 
the message monitoring program executable code is loaded. 

11. The method of claim 7, furtheX comprising the step 
of including in the header a flag indicative of the length of 
the encrypted data, and a flag that allows \he message 
monitoring program to search for the beginning of the 
encrypted data. \ 

12. The method of claim 5, wherein an action^ includes 
deleting a temporary file from a mass storage devic\, wherein 
the deletion includes the steps of wiping the device Nsectors 
of the data contained therein, and renaming the temporary file 
to a name consisting of one letter prior to deletion. \ 
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13. the method of claim 12, wherein the wiping is 
performed in conformance with the standards set for in the 
Unired States National Industrial Security Program Operating 
Manuals 

14. Yrhe method of claim 6, wherein an action includes 
compressing^ said associated file. 

15. The method of claim 6, wherein an action includes 
translating saidNassociated file into another language. 

16. The methodVof claim 6, wherein an action includes 
converting said associated file into another file format. 

17. The method of ciaim 6, wherein an action includes 
searching for a virus in said associated file. 

18. The method of claim V>, wherein an action includes 
altering text in said associates! file. 

19. The method of claim 6, wfterein an action includes 
changing or adding an optional setting to said associated 
file. 

20. The method of claim 6, wherein ^ action includes 
spell checking said associated file. 

21. The method of claim 6, wherein an ac\ion includes 
creating a backup of said associated file, 



22. The method of claim 6, wherein an action Yncludes 
versioning said associated file under a different nar^ or 
stream each time said associated file is saved. 
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23. The method of claim 6, wherein an action includes 
storing said associated file content in a remote location, and 
storing a reference of said associated file locally. 

24\ The method of claim 6, wherein an action includes 
grammar checking said associated file. 

25. TheNmethod of claim 1, further comprising monitoring 
by the message monitoring program window function the creation 
of a document chiM window. 

26. A method f or\intercepting a software call to a 
function contained in a oynamically linked library comprising 
the steps of: \ 

obtaining from an operating system by an intercepting 
program the address of an executable program; 

locating in a header of theVexecutable program a list of 
libraries and functions called by\he executable program; 

substituting a function reference in an import table of 
the executable program with a reference to a function in a 
library of the intercepting program; ami 

storing said function reference in ah internal memory 
structure. \ 

27. The method of claim 26, wherein saidNexecutable 
program header includes an import table, f urther\comprising 
examining the import table in order to locate the Vist of 
libraries and functions called by the executable program. 



28. The method of claim 26, wherein the function 
reference is an ordinal number. 



29 



^^ket No.: 700-202RP 

29. The method of claim 26, wherein the function 
reference is a name. 

\30. The method of claim 26, further comprising 
obtaining the address of a library, said library 

including^an import table; and 

substituting a function reference in the import table of 

the library with^a reference to a function in a library of the 

intercepting progr&m. 

31. The method or\claim 30, wherein the library address 
is obtained from the operating system. 

32. The method of claim 3s0, wherein the library address 
is obtained from the import tableNof the executable. 

33. The method of claim 26, furtn&r comprising replacing 
the address of an API function in the import table of the 
executable with the address of a function of N^e intercepting 
program, said function having a return value comprising a 
table of addresses of one or more functions, whereirk the 
intercepting program function inspects the table of adHresses 
returned by the API function and inserts one or more \. 
substitute function addresses into the table of addresses. 
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